diff --git a/nas/nas-install.md b/nas/nas-install.md
index 77d42ab..37d8fc8 100644
--- a/nas/nas-install.md
+++ b/nas/nas-install.md
@@ -416,7 +416,30 @@ instances depend on that host surviving.
 
 Once `tank` has run a week on SATA with **zero** pool suspensions and no
 CRC errors, the `usb4t-dropouts` gate is cleared — record that in
-[ks2/plan.md](../ks2/plan.md).
+[ks2/plan.md](../ks2/plan.md). Day 1 was clean (2026-08-31).
+
+### Clearing the inherited `<metadata>` errors — order matters
+
+The pool imported carrying `<metadata>:<0x0>` and `<metadata>:<0x3d>` from
+the 2026-08-29 USB dropout. A scrub found **0 errors and repaired 0B**,
+yet the entries stayed, and a plain `zpool clear` afterwards did not drop
+them either. ZFS flushes its persistent error log on a scrub that runs
+**after** the clear — so the working order is:
+
+```sh
+zpool clear tank
+zpool scrub tank        # this is the run that flushes the log
+```
+
+Result 2026-08-31: `scrub repaired 0B in 02:34:24 with 0 errors`,
+`errors: No known data errors`, `all pools are healthy`. They were
+artefacts of interrupted writes, not corruption — matching the
+[2026-08-28 incident](../nuc/usb4t-dropouts.md).
+
+⚠️ This matters for monitoring, not just tidiness: while those entries
+stand, `zpool status -x` reports the pool unhealthy permanently, so
+`zpool-health.sh` sits in the alarm state and **cannot signal a new
+problem**. Clear them before trusting the watchdog.
 
 ## 6. Incus
 
@@ -804,11 +827,15 @@ trace can be recut against the meter's series afterwards.
 
 - [x] IPMI **left unplugged by decision** (2026-08-30) — no BMC on the
       LAN, therefore no out-of-band console either
-- [ ] `cat /proc/mdstat` — all three arrays `[UU]`; GRUB written to **both**
-      ESPs (`efibootmgr -v` shows two entries),
-      and boot tested with one disk unplugged
-- [ ] `zpool status` healthy for `incus` and `tank`; weekly scrubs
-      scheduled; both import cleanly after a reboot (`cachefile` set)
+- [x] `cat /proc/mdstat` — all three arrays `[UU]`; GRUB written to
+      **both** ESPs, both mounted, `debian` + `debian-b` boot entries
+      present (verified across a cold boot 2026-08-31)
+- [ ] boot still untested with **one disk physically unplugged** — the
+      mirror is a guess until that is done
+- [x] `zpool status` healthy for `incus` and `tank`; weekly scrubs
+      scheduled; **cold boot verified 2026-08-31** — both pools imported
+      from `/etc/zfs/zpool.cache`, all instances autostarted, NFS exports
+      republished, 0 failed units
 - [ ] **7 days with zero pool suspensions and zero CRC errors** — the
       gate that closes [usb4t-dropouts.md](../nuc/usb4t-dropouts.md)
 - [x] `smartd` monitoring all 3 disks; `zpool-health.sh -t` mail
diff --git a/nuc/jellyfin-client.md b/nuc/jellyfin-client.md
index bcd640b..45a7c1c 100644
--- a/nuc/jellyfin-client.md
+++ b/nuc/jellyfin-client.md
@@ -447,6 +447,23 @@ incus exec jellyfin-client -- udevadm info /dev/input/event0    # udev db visibl
   visible (#2); check `run-udev.mount` is active.
 - **Video OK, no sound; JMP log shows `AO: [null]`** → ALSA default broken
   (#3); check `/etc/asound.conf` and the card name in `aplay -l`.
+  **Most common cause: the Pioneer DAC is simply switched off.**
+  `/etc/asound.conf` pins the default to it *by card name* (`Device`), so
+  with the amp off the name does not exist and `default` fails to open —
+  mpv then falls back to null silently: picture, no sound, no error.
+  One-line check before blaming anything else:
+  ```sh
+  incus exec jellyfin-client -- su -s /bin/bash kiosk -c 'aplay -D default -d 1 /usr/share/sounds/alsa/Front_Center.wav'
+  ```
+  `audio open error: No such device` = amp is off. Power it on; no
+  restart needed, JMP opens the device per playback.
+- **Display hotplugged after boot → cage exits once, then recovers by
+  itself.** If the kiosk started with no outputs, plugging the HDMI in
+  makes cage fail (`Failed with result 'exit-code'`); the unit's
+  `Restart=on-failure` / `RestartSec=5` restarts it ~5 s later, this time
+  with the display present. **Do not restart it by hand** — check
+  `systemctl show jellyfin-kiosk -p ActiveEnterTimestamp` first and only
+  intervene if the timestamp predates the hotplug. Verified 2026-08-31.
 - **Keyboard plugged in after boot isn't seen** — the host udev db is live
   through the bind, but udev hotplug *events* don't cross the container's
   network namespace, so cage only enumerates at startup. Re-plugging the